[ANAMASGARD]

Summary

• preserve raw evaluation status while deriving framework-specific effective views
• retain exact framework/control/rule tuple correlation
• centralize case-insensitive and regex exception matching
• aggregate selected frameworks without leaking scoped exceptions
• propagate status and substatus through rule, control, resource, framework, and top-level results
• preserve action-required behavior across JSON without adding a serialized field
• add order-independence, aggregate, regex, tuple-correlation, legacy JSON, and end-to-end regressions

Verification

• focused affected-package tests pass
• repository-wide tests pass
• race tests pass
• build and go vet pass

Related to #187

This PR covers the opa-utils result model. The Kubescape manual-control integration will follow separately after an opa-utils release.'

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 6866eafa-4683-46e3-b534-d78c88227284

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Reviewed the framework-scoped exception flow end to end. The raw evaluation remains immutable, tuple correlation is preserved, aggregate and per-framework status/substatus semantics are covered (including action-required and JSON round trips), and the shared regex matcher is concurrency-safe. I found no blockers. Locally verified with go test ./..., go test -race ./..., go vet ./..., and git diff --check origin/main...HEAD.